[PATCH nft] netlink: fix element addition to map with stateful object

[Pablo Neira Ayuso <pablo@netfilter.org>]

Expressions with EXPR_F_INTERVAL_END flag set on have no right hand side,
so they store no stateful object. Skip them so we don't crash on this.

 # nft add map x testmap { type inet_service: counter\; flags interval\;}
 # nft add counter x testcounter
 # nft add element x testmap { 0-100 : "testcounter" }
 Segmentation fault

This patch also fixes the listing codepath.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1190
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/netlink.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/netlink.c b/src/netlink.c
index d5d410a84762..e8d0e31348f0 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -261,7 +261,7 @@ static struct nftnl_set_elem *alloc_nftnl_setelem(const struct expr *set,
 			break;
 		}
 	}
-	if (set->set_flags & NFT_SET_OBJECT) {
+	if (set->set_flags & NFT_SET_OBJECT && data != NULL) {
 		netlink_gen_data(data, &nld);
 		nftnl_set_elem_set(nlse, NFTNL_SET_ELEM_OBJREF,
 				   nld.value, nld.len);
@@ -1595,8 +1595,13 @@ static int netlink_delinearize_setelem(struct nftnl_set_elem *nlse,
 		expr = mapping_expr_alloc(&netlink_location, expr, data);
 	}
 	if (set->flags & NFT_SET_OBJECT) {
-		nld.value = nftnl_set_elem_get(nlse, NFTNL_SET_ELEM_OBJREF,
-					       &nld.len);
+		if (nftnl_set_elem_is_set(nlse, NFTNL_SET_ELEM_OBJREF)) {
+			nld.value = nftnl_set_elem_get(nlse,
+						       NFTNL_SET_ELEM_OBJREF,
+						       &nld.len);
+		} else
+			goto out;
+
 		data = netlink_alloc_value(&netlink_location, &nld);
 		data->dtype = &string_type;
 		data->byteorder = BYTEORDER_HOST_ENDIAN;
-- 
2.11.0